#1094 Remove the ambient ripgrep dependency from the test suite

[williamthorsen]

What

Tests and the post-build smoke check no longer depend on ripgrep. Separately, the knowledge-base retrieval skills now fail with an explicit error when ripgrep returns output they cannot interpret, instead of reporting an empty result when matching notes exist.

Why

Thirty-seven tests across four files required rg on PATH, and a workflow modernization that dropped the step installing it left the build red. Most of those tests had no stake in ripgrep, reaching it only in passing, so an absent binary failed tests about candidate tables and filters with an error naming the recall module rather than the missing prerequisite.

Taking every test off the real binary also removes the only thing that would have caught a change to ripgrep's --json event format, so recall has to detect that condition itself.

Details

♻️ Refactoring

• recallNotes accepts an optional process runner and reaches rg only through it, so its own tests assert the constructed argument list and exercise the exit-code and missing-binary branches without spawning anything. The runner's contract matches the shape packages/fleet/src/forge/github-adapter.ts already establishes.
• searchNotes accepts an optional recall function, threaded through runRetrieve in both retrieve CLIs, so a test of scoping, filtering, or projection supplies hits directly and never reaches the process layer. The seam is recall rather than the process runner because threading the runner that far would force consumer tests to author ripgrep --json events carrying machine-absolute paths, which is matching reimplemented in test code.
• searchKb throws when ripgrep returns output that parses to no entries. ripgrep exits 1 when nothing matched, so a zero exit carrying output guarantees at least one match event, and parsing none of it means the --json event shape no longer matches what the module reads.
• searchKb maps parsed entries straight to hits, dropping a per-path de-duplication that parseRipgrepOutput already guarantees.

🧪 Tests

• recall.test.ts pins the full ripgrep argument list, and asserts metacharacter escaping, disjunctive term combination, and alias expansion against the constructed pattern. All four failure branches (no-match exit, absent binary, other non-zero exits, unparseable output) run through a fake runner.
• Structural path extraction and the snippet cap move to parseRipgrepOutput tests over synthetic events, replacing four tests that proved the same point by matching real notes under date-patterned paths.
• Both retrieve CLI test files and search.test.ts declare which notes recall found, through a shared buildRecallStub helper that resolves basenames to absolute paths and attributes each hit to its in-scope KB. Declaring the hit set is a stronger statement than the implicit matching it replaces, and it lets several assertions tighten from a lower bound to an exact count.
• The kb-retrieve-events smoke pairing scopes to a store the registry does not carry, which short-circuits before recall while still asserting a structural result rather than falling back to the bare no-args baseline.
• Four fixture notes existed only to be matched by the real binary and are removed with the tests that read them.
• Verified by prepending a directory holding an rg shim that logs its arguments and exits non-zero: the full repository suite, the post-build smoke run, and nmr build && nmr check:strict all pass with an empty log.

Closes #1094

[github-actions]

Dependency audit

Production dependency audit passed.